Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upUser Agent Client Hints #202
Comments
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
/cc @miketaylr - who shown interest in the feature when we discussed it at ViewSource |
This comment has been minimized.
This comment has been minimized.
|
Hey @yoavweiss - sorry for the delay here. I've been having discussions with Tanvi and @martinthomson about the User Agents Hints proposal and here's some draft language that could maybe result in a position: DescriptionThe UA Hints proposal aims to solve the following problems associated with the User Agent (UA) string: UA sniffing, UA spoofing, and an entropy-rich target for fingerprinting. The proposal is to build on top of the Client Hints infrastructure and solve these problems over time. (Draft) Mozilla's PositionUsing Client Hints to deliver info derived from the User Agent header for servers who specifically request this information may reduce the number of parties that can use this information for passively fingerprinting users. However, we could reduce this even further by freezing the User Agent string and requiring resources to actively request this information via the proposed NavigatorUAData interface JS APIs. This would also allow us to audit the callers. At this time, freezing the User Agent string without any client hints—seems worth-prototyping. We look forward to learning from other vendors who implement the “GREASE-like UA Strings” proposal and its effects on site compatibility. Less formal version: We're very interested in the freezing UA string stuff and But I don't think the positive points change our position on Client HInts (which is currently "non-harmful"). @martinthomson could probably expound on that. |
This comment has been minimized.
This comment has been minimized.
|
Thanks, @miketaylr -- after double-checking with Martin, and reading @dbaron's comment above as not varying from the related Client Hints position, I'm closing this and adding your proposed text to the spreadsheet. |
Request for Mozilla Position on an Emerging Web Specification
Other information
The
User Agentheader that is being sent today on every request provides an excellent source of entropy that can be used to passively fingerprint users. It would be great if browsers could stop sending that information by default to all servers, regardless of whether those servers need it or not.The User Agent Client Hint proposal is destined to replace the
User Agentheader, to achieve the following:The above will enable browsers to keep track of servers that collect that information, and take actions to protect users' privacy in cases where that collection is likely abusing it.
Another interesting characteristic of reseting access to the UA string is that it can allow browsers to apply GREASE to the new values, in order to prevent the negative implications of UA sniffing seen on the web today.